Wrap-unwrap of private key using EC master key

Question

I want to wrap a private key out of a HSM, using an external EC key pair (master key) and then verify that I can recover it.
The wrapping occurs as follows:

1. Generate a secret AES key in the HSM, using the public part of the EC master key, the private part of the internal key pair and the derivation mechanism CKM_ECDH1_DERIVE. The derivation parameters for this mechanism are: derivation function CKD_SHA256_KDF, shared data and public data (public data are taken from the public EC master key).
2. Wrap the private key, using the secret AES key and a mechanism such as CKM_AES_GCM, CKM_AES_KEY_WRAP_PAD or CKM_AES_CBC_PAD.
3. The HSM returns a byte array.

Could someone tell me if I'm doing right and what I should use as shared and public data when the HSM generates the secret key?
Then, how could I recover this private key, with the help of the private part of the EC master key pair, in order to be sure that the process works well?

Answer 1

Could someone tell me if I'm doing right

This is generally the way this is performed yes, as IES as explained in your other question.

The internal key pair needs to be ephemeral, i.e. you'd need to generate a new key pair for each key that is wrapped. This means that it should be a session key in the HSM.

Note that the IV is generally static. This is a huge issue as this means that private key information of the wrapped key may be leaked. For CBC mode you'd think that it would be relatively secure, but please remember that asymmetric, private keys are generally not fully randomized.

what I should use as shared and public data when the HSM generate the secret key

The shared data is the data used within the KDF as optional parameter. The shared data is inconsequential in this case, and might be NULL, or something like the ASCII representation of "WRAPPING_KEY" or something similar.

The public data is simply the public key of the EC "master" key pair.

Then, how could I recover this private key, with the help of the private part of the EC master key pair, in order to be sure that the process works well?

You perform the same operation using the public key of the internal key pair which you need to export and the EC master key. You'd have to use the same key derivation mechanism (KDF), with the same shared data. For EC key derivation you'd need to perform the KDF over the statically sized X-value of the ECDH (called "Z" in the standard, you'd need to get the ANSI or ISO standard to get why). Then you perform the decrypt / unwrap, giving you the encoded private key, which you'll probably have to decode.